//go:build ignore

#include "vmlinux.h"
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_helpers.h>

char __license[] SEC("license") = "GPL";

struct event {
	u32 pid;
	u32 uid;
	u8 comm[40];
	u8 buf[3000];
};

// Force emitting struct event into the ELF.
const struct event *unused __attribute__((unused));

struct {
	__uint(type, BPF_MAP_TYPE_RINGBUF);
	__uint(max_entries, 256 * 1024);
} rb SEC(".maps");

SEC("uprobe")
int BPF_KPROBE(uprobe_SSL_write_ex, int *s, const void *buf) {
	struct event *e;

    e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0);
    if (!e) {
        return 0;
    }

	e->pid = bpf_get_current_pid_tgid() >> 32;
	e->uid = bpf_get_current_uid_gid();
	bpf_get_current_comm(&e->comm, sizeof(e->comm));
	bpf_probe_read_user(&e->buf, sizeof(e->buf), buf);

	bpf_ringbuf_submit(e, 0);
	return 0;
}
